Prepared by: Murray Jose-Boerbridge, OODP Consultant Edits by: Wendy Pinder, OODP Program Administrator and Dionne A. Falconer, OODP Consultant

Transcription

1 Risk Management Planning Toolkit Prepared by: Murray Jose-Boerbridge, OODP Consultant Edits by: Wendy Pinder, OODP Program Administrator and Dionne A. Falconer, OODP Consultant January 2017

2 Copyright Statement Production of the Risk Management Planning Toolkit has been made possible through financial contributions by the AIDS Bureau, AIDS and Hepatitis C Programs, Ministry of Health and Long-Term Care, Ontario. Copyright to the Risk Management Planning Toolkit is held by the Ontario Organizational Development Program (OODP). The OODP acknowledges the contributions of its consultant, Murray Jose-Boerbridge, in preparing this document. The OODP encourages the use of the Risk Management Planning Toolkit by organizations. However, any such publication shall acknowledge the OODP as the source and Murray Jose-Boerbridge as the contributor. Its content cannot be edited or otherwise altered without permission of the OODP The Ontario Organizational Development Program 2

3 1. Introduction There is risk inherent in everything we do. Volunteers, employees and directors of organizations must always be mindful of risks this means examining situations cautiously and thinking ahead to the potential consequences of their decisions and actions. (Volunteer Canada, 2003) All organizations, regardless of size or mandate, face risk, namely the potential of losing or gaining something of value. Once a risk has been identified, an organization has options for addressing it, such as the following: avoid the risk, i.e. choose not to take on certain activities; reduce the risk, i.e. modify certain activities; transfer the risk, i.e. purchase insurance or outsource certain activities; or accept the risk, i.e. assess the possible impact, mitigate or reduce it where possible, and identify a response or plan if it does occur. Figure 1: Risk Management Strategies PREPARATION Identify Assess Determine Response PREVENTION Policies & Procedures Staff/Volunteer Competence Organizational Culture PROTECTION Insurance Contracts Contingency Plans Source: Guide to Good Governance Second Edition, Ontario Hospital Association, The OODP has developed a Risk Management Planning Toolkit 1. It outlines a risk management planning process which is a structured, systematic, thoughtful approach to identifying, assessing and responding to risks. The Toolkit can be used by a Board of Directors and management as both a governance tool and a component of organizational planning. This Toolkit has been developed for the HIV sector. It builds on the sector s focus on capacity, resilience and strength-based approaches. It affirms the sector s ongoing commitment to 1 In addition to the References, operational documents were accessed from the AIDS Committee of Toronto, Medic Alert, Regional HIV/AIDS Connection, and Toronto People with AIDS Foundation in the development of this Toolkit The Ontario Organizational Development Program 3

4 organizational performance and accountability, as well as the need to respond to changing accounting standards, legislative requirements and funder expectations. It acknowledges the introduction in recent years of a broader interpretation of risk beyond strictly financial and legal risk to also include aspects such as reputational (stakeholder confidence/ trust) and service delivery risk. The Toolkit consists of a 2-step process for risk management planning with a template for each step: 1. Step 1: Risk Assessment Checklist; and 2. Step 2: Risk Response Matrix. The Risk Assessment Checklist provides an extensive list of activities and issues for which a risk and/or opportunity can be identified. It is designed to be simple and manageable for organization leaders to complete within an environment of multiple competing priorities. The Risk Response Matrix incorporates best practice for risk management processes to more deeply explore, plan for and manage risk. It is to be done after the Risk Assessment Checklist has been completed. 2. Risk, Opportunities & Change There are significant interactions between organizational risk, opportunity and change. Many risks and opportunities arise from change. Organizational leadership activities involve responding to these changes, and AIDS Service Organizations (ASOs) have proven capacity, agility and resilience in this. Responding to organizational change usually requires resources of both time and money. In addition, it can sometimes create a sense of instability or a feeling of being in a state of constant crisis response. In extreme situations, it may not be possible to effectively address organizational change after it has occurred and long-term impact on organizational capacity and work may occur. Risk management planning supports an organization s leadership to be pro-active. It also supports the leadership to identify possible change as a risk or opportunity and then to plan for and manage the risk as well as minimize the impact on organizational resources. For example, an organization has heard that there may be a change in ownership of a local bar that has been a long-time supporter of the organization s outreach and fundraising activities. Possible responses might include: identify the situation as a risk during completion of the Risk Assessment Checklist and conduct in-depth planning to manage the potential risk using the Risk Response Matrix; identify the situation as an opportunity during completion of the Risk Assessment Checklist and add it to the future workplan priorities for the Executive Director or another appropriate staff to further develop, e.g. plan time for stewardship of new relationships; respond immediately, e.g. confirm in writing with the current owner how much notice the organization will require for any changes that would impact organizational activities The Ontario Organizational Development Program 4

5 3. Integrating Risk Management Planning The Toolkit is designed to be adapted. As such, the process and roles identified for risk management planning should best meet the needs, systems and capacity of the organization. The listed activities and issues should be modified to reflect those specific to the organization. A risk management planning process should be undertaken at least once a year and it should inform, relate and link to ongoing organizational planning and accountability systems. For example: As Executive Directors deal with unexpected change and related issues, risks or opportunities may be identified for inclusion in the Risk Assessment Checklist see OODP Leading Change in ASOs: A Resource for Executive Directors; Monthly reporting on compliance in the Executive Director s report to the Board can inform the annual completion of the Risk Assessment Checklist see OODP Executive Director Board Report Guide; Actions and monitoring identified within the Risk Response Matrix can be added to Board workplans and agendas, as well as to staff workplans see the OODP Board Workplan Calendar, OODP Board Agenda Template, OODP Board Risk Management and Financial Oversight Checklist and OODP Staff Workplan Guide; Templates and support for mitigating risks related to employment relationships can be accessed from the Ontario Provincial Resource for ASO Human Resources (OPRAH) and integrated into the Risk Assessment Checklist and/or Risk Response Matrix; A Strategic Plan Implementation Plan can be informed by the Risk Assessment Checklist to proactively include measures for monitoring or addressing risk; Undertaking the OODP Organizational Self-Assessment Tool (OSAT) process provides an opportunity for an in-depth and supported process of assessing organizational strength, capacity and potential risk; and Results from the completion of the Risk Assessment Checklist and/or Risk Response Matrix can inform more thoughtful annual program planning and budgeting discussions The Ontario Organizational Development Program 5

6 4. Risk Management Planning Templates Step 1: Risk Assessment Checklist To complete the Checklist: 1. Review and modify the list of activities and issues to reflect those that are relevant for the organization. 2. For each activity or issue, identify whether it is a Risk and/or Opportunity. 3. For each activity or issue, comment on what makes it a risk or opportunity. 4. For activities and issues identified as a Opportunity, integrate them into an appropriate organizational planning system, e.g. strategic planning, implementation planning, operational planning, Board workplanning or staff workplanning. 5. For activities and issues identified as a Risk, note them in and complete the Risk Response Matrix. Activity / Issue Risk Opportunity Comments Service Delivery (Client Experiences and Outcomes) Organizational programs List specific organizational program categories in separate rows, such as: Support Programs Food Programs (e.g. expected closure of community kitchen where programming partnerships are hosted) Prevention Education Outreach (e.g. announced rise in municipal costs for disposing of harm reduction materials) Housing Support Community partnerships List significant organizational partnerships in separate rows, such as (reference OCHART): ASO (operational partnership) Define type of risk or opportunity 2017 The Ontario Organizational Development Program 6

7 Activity / Issue Public Health (testing partnership) Mental Health & Addictions (service partnership) Community services (e.g. loss of referral partner, new supportive housing) Client demographics ( e.g. identified spike in number of clients reaching 65 yrs. of age potentially impacting ODSP and other support needs) Client needs (e.g. client survey or community report identifying change in needs) Community loss (e.g. death of multiple, well-known clients/volunteers/staff) Compliance Service Delivery Outreach and home visit safety procedures Client and service statistical reporting Program evaluation (as required by agency policies, annual workplans, funder agreements) Program development (e.g. new, expansion, required intentional strengthening) Feedback & Complaints (e.g. formal policy & procedures in place, quantity change or trend) Legislation impacting client needs Externally initiated interventions/ programs (e.g. regionally/ provincially/ nationally developed with local partnership opportunity) Policies & procedures Risk Opportunity Comments Human Resources (Staff, Volunteer, Peers, Students) Staff turnover/transition 2017 The Ontario Organizational Development Program 7

8 Activity / Issue Staff relations and morale Succession process and planning Union relations Employee benefits Orientation (e.g. resources & processes - including signed acknowledgement of participant) Training Volunteer relations & morale Grievances, Human Rights complaints Harassment or Assault (e.g. aware of active client with past aggressive behaviours) Compliance Human Resources Employment Standards Act Employer remittances (WSIB premiums, Employer Health Tax (EHT) Signed contracts and forms (e.g. confidentiality) Regular performance appraisals Collective Agreement requirements (e.g. providing staff & seniority lists) Personnel files (e.g. current & accurate) Volunteer files Volunteer management processes Volunteer retention Policies & Procedures Risk Opportunity Comments Finance & Operations (Finance, Information Technology [IT], Facilities) Board approved budget (e.g. staff input, reflective of strategic plan implementation) Regularly reviewed financial statements and forecasts External audit 2017 The Ontario Organizational Development Program 8

9 Activity / Issue Compliance Finance & Operations Taxes (e.g. payroll, HST, property) Annual Charity Return T3010 Annual Corporations Return Occupational Health & Safety Act Privacy legislation (IT) Signing authority & delegation Capital budget (e.g. decisions, policy) Investments (e.g. decisions, policy) Changes to Collective Agreement (e.g. payroll, benefits) Overall financial stability of agency Accounting practices (e.g. Accounting Standards for Not-for-Profit Organizations [ASNFPO], International Financial Reporting Standards [IFRS], Canadian Auditing Standards [CAS]) Grant revenue (e.g. loss of historic grant or new grant opportunity) Philanthropy revenue Decline or loss of key event 3 rd Party community support (e.g. signed agreement in place) Donor relations Fraud or theft Facilities e.g. (lease, maintenance, accessibility) Capital renewal (e.g. equipment, facilities) Agency insurance (e.g. comprehensive, asset) Information Technology Hardware Software Data integrity Compatibility (e.g. Funder reports, Internal donor database, OCASE) Risk Opportunity Comments 2017 The Ontario Organizational Development Program 9

10 Activity / Issue Accessibility Social media capacity Procurement management (e.g. contracts) Policies & Procedures Risk Opportunity Comments Strategy & Planning Organizational planning Strategic Plan Strategic Plan Implementation Plan Operational Plan Annual Board Workplan Annual Staff Workplan Board of Directors Sufficient for quorum Appropriate composition for skills required Reflective of diversity of agency s community Board orientation and training Board Self-Assessment ED Board Report Operational performance assessment Organizational milestone (e.g. anniversary, merger) ED succession plan Policies & Procedures Accountability (tools, processes, training, and systems to measure accountability to client, donor, funder and community) Organizational culture (e.g. intentionally reflecting strategic plan, sustainable, collective memory, reflected in concrete organizational processes) AGM 2017 The Ontario Organizational Development Program 10

11 Activity / Issue Required notice to members for AGM Required notice to members for By-Law Changes Approval of audited financial statements by members Compliance Funder obligations (e.g. confirmation of submission) Accessibility for Ontarians with Disabilities Act (AODA) Corporate & foundation reports Canada s Anti-Spam Legislation (CASL) Board insurance Preparedness plan (e.g. flu pandemic resulting in disrupted or reduced operations) Sector engagement Actively engaging with Priority Population Networks (PPNs) Participating in HIV Resources Ontario sessions and utilizing resources Contributing organizational resources and knowledge through SAGE and other tools Legal claims Organizational membership (e.g. stable, sufficient for quorum) GIPA/MEPA (e.g. policies, practices, visible commitment, communication, impact) Policies and procedures Risk Opportunity Comments 2017 The Ontario Organizational Development Program 11

12 Step 2: Risk Response Matrix To complete the Matrix: 1. In the appropriate section under Risk, note each activity or issue identified as a Risk in the Risk Assessment Checklist. 2. Fill in the table for each identified risk using the legends below. RISK VALUE/ RANK LIKELIHOOD IMPACT Service Delivery (Client Experiences and Outcomes) CONTRIBUTING/MITIGATING FACTORS ACTIONS/CONTROLS REQUIRED LEAD (Board, ED, Committee) COMPLETION DATE Human Resources (Staff, Volunteers, Peers, Students) Finance & Operations (Finance, IT, Facilities) 2017 The Ontario Organizational Development Program 12

13 RISK Strategy & Planning VALUE/ RANK LIKELIHOOD IMPACT CONTRIBUTING/MITIGATING FACTORS ACTIONS/CONTROLS REQUIRED LEAD (Board, ED, Committee) COMPLETION DATE Accountability RISK VALUE/RANK High Medium Low LIKELIHOOD SCORING KEY Likelihood Score Probability of Occurrence 1 Improbable, Unlikely, No Change 2 Likely Change or Occurrence within Planning Year 3 Expected Change or Recurrence within 2 Years NOTE: Some organizations also include assessment of tolerance as a component of Risk Management Planning The Ontario Organizational Development Program 13

14 IMPACT SCORING KEY Impact Score Impact 1 Service delivery unlikely impacted Stakeholder confidence unlikely or slightly impacted (e.g. small number of stakeholders; strong communication response available; type of resonance/importance placed on issue by stakeholders) Complaint possible, litigation unlikely Agency stability not expected to be impacted $0-$25K 2 Service delivery possibly impacted Stakeholder confidence possibly impacted (potential for negative publicity, not likely prolonged, communication response available) Complaint probable, litigation possible Agency stability not likely impacted or for a short period $25K-$100K 3 Service delivery possibly impacted Stakeholder confidence likely impacted (serious negative publicity, possibly prolonged, reaching more than two stakeholder groups) Complaint expected Litigation likely Agency stability impacted (possible resignation of senior management and/or Board, loss of community philanthropy revenue) >$100K 2017 The Ontario Organizational Development Program 14

15 References 1. Bertrand, N. and Brown, L. (2006). Risk Management, A Guide for Non-Profit and Charitable Organizations. Accessed at 2. Carter, T.S. and Demczur, J. M. (2013). Legal Risk Management Checklist for Not-For-Profit Organizations. Accessed at 3. Deazeley, B. and Williams, D. (2014). Strategic Planning, Risk and Oversight for Not-for-Profit Organizations. Accessed at 4. DIY Committee Guide (Volunteer Now) Code of Good Governance. What is a Risk Management Strategy? Accessed at 5. National Council for Voluntary Organisations KnowHow NonProfit. How to Manage Risk. Accessed at 6. Ontario Hospital Association: Governance Centre of Excellence (2011). Guide to Good Governance Second Edition. Toronto: Ontario Hospital Association. 7. Ontario Organizational Development Program (2014). Board Risk Management and Financial Oversight Checklist. Accessed at 8. Ontario Organizational Development Program (2015). Leading Change in AIDS Service Organizations: A Resource for Executive Directors. Accessed at 9. Ontario Organizational Development Program (2016). Organizational Self-Assessment Tool. Accessed at Volunteer Canada (2012). Canadian Code for Volunteer Involvement. Accessed at The Ontario Organizational Development Program 15